Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Operation Triangulation: What you get when attack iPhones of researchers

securelist.com

Post reply on HN
Print view View original

321–330 of 433 posts

Re: Operation Triangulation: What you get when attack iPhones of researchers

#321

Post by kernal »

Brybry wrote: post #272
nvm0n2 wrote: post #200

Earlier quoted context omitted.

iOS has a reputation for having the best security, but how many times have Android/WhatsApp had these sorts of silent-instant-root exploits via invisible messages? I don't remember it happening. Maybe the strategy of writing lots of stuff in Java is paying off there.

Android has had zero click exploits. For example, Stagefright [1] And even better, there are plenty of old Android phones out which will be vulnerable to various exploits because of weak OTA update support policies. [1] https://en.wikipedia.org/wiki/Stagefright_(bug)

Sigh…there has never been an 0day Stagefright exploit in the wild. And even if there was it wouldn’t have worked on all Android devices due to the OS differences among OEMs.

Also, there are plenty of old iPhones that do not receive updates anymore and are just as vulnerable so I’m not sure why you needed to get that in.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#323

Post by stephen_g »

nvm0n2 wrote: post #204
Despegar wrote: post #126

I'm curious to know from experts if there's anything Apple can do to create a step-change in terms of security of iPhones? Like if the going rate for a zero day is $1 million, is there anything Apple can do that can drive that up to $2 or $3 million? Or is it just going to be a perpetual cat and mouse game with no real "progress"?

Sure. Rewrite sensitive parts of their stack in memory safe languages. They have Swift after all. A lot of the iOS security improvements over time have really been more like mitigations that try to contain the damage when the giant of pile of decades old C gets exploited.

That is exactly their plan. Swift could always link into C applications, and they have recently come out with C++ interoperability [1] so things like WebKit etc. can start having parts re-written or new parts written from the start in Swift so they can gradually replace C and C++ codebases instead of trying to rewrite everything (which sucks because even for things much, much less complex than WebKit, you can have a team working for three years working on a replacement and it’ll have less features than the original had when you started).

They’re even working on an embedded subset for embedded devices so things like microcontrollers like battery management, the Secure Enclave etc. can run it.

1. https://m.youtube.com/watch?v=lgivCGdmFrw

Re: Operation Triangulation: What you get when attack iPhones of researchers

#324

Post by henriquez »

mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

This is a fairly incredible attack, and agree with your analysis. The hidden Safari tab portion where they “re-hack” the device could be bad organizational siloing as you mentioned or indicative of a “build your virus” approach that script kiddies used in the 90s. Could be a modular design for rapid adaptation, ie. perhaps less targeted.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#325

Post by duskwuff »

smallnix wrote: post #289
londons_explore wrote: post #230

Coresight is not some backdoor - it's a debug feature of all ARM CPU's. This looks like a necessary extension to coresight to work with Apples memory protection stuff. Even though no public documentation exists, I'm sure thousands of Apple engineers have access to a modded gdb or other tooling to make use of it.

That does not explain the weird hashing.

As explained by marcan: it's not "hashing", it's an error-correcting code. Much more understandable in that light.

https://social.treehouse.systems/@marcan/111655847458820583

Re: Operation Triangulation: What you get when attack iPhones of researchers

#326

Post by eviks »

woodruffw wrote: post #149
eviks wrote: post #141

Earlier quoted context omitted.

It may cost a million, but it doesn't follow that every use(r) costs the same (could even also call this a category error). Neither is "going to get you" a given, maybe another agency is in charge of the alternative methods of getting you, and they have different priorities that doesn't include your target (or alternative ways are much more expensive or too slow to be worth it)

The point is that it's incorrect to think of the US (or any other country's) IC as a force of nature, blasting out 0days to random civilians just for kicks. These things are expensive, very expensive, and are carefully orchestrated. They don't look anything like the average civilian's security breach, which is somewhere between "accidentally leaked their own password" and "TSA asks you to unlock your phone."

Neither is it correct to believe the myth of careful orchestration with only rational institutional goals and deep care about other people's money (though again, develop/use are different "these things")

Re: Operation Triangulation: What you get when attack iPhones of researchers

#327

Post by henriquez »

Veserv wrote: post #246
mike_hearn wrote: post #76

Earlier quoted context omitted.

I don't think hiring an ex-Apple dev would let you get the needed sbox unless they stole technical documentation as they left. So it either has to be stolen technical docs, or a feature that was put there specifically for their usage. The fact that the ranges didn't appear in the DeviceTree is indeed a bit suspicious, the fact that the description after being added is just 'DENY' is also suspicious. Why is it OK to d…

It should be very easy to add one without somebody noticing. This is the same Apple which shipped a version of macOS for months that added the ability to login to root with any password only a few years ago. Their review processes are so incompetent even one of the most security critical components, root login, let a totally basic “fail your security 101 class” bug through. It is absolutely inexcusable to have a proc…

I’m not trying to defend Apple but I think that line of thinking is pretty cynical and could be used to condemn basically any company or open source project that attracts enough interest for attackers.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#328

Post by throwaway81523 »

Philip Zimmermann a while back was working on a secure phone product called the Black Phone. I tried to convince him that a secure phone should not contain any microphones of any kind. That sounds a bit weird for a phone, but it's ok, if you want to make a voice call, just plug a headset into it for the duration of the call. He wasn't convinced, but this iphone exploit makes me believe it more than ever.

Re: Operation Triangulation: What you get when attack iPhones of researchers

#329

Post by stephen_g »

jsjohnst wrote: post #211
mike_hearn wrote: post #43

That's pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and/or that they hacked Apple and obtained internal hardware documentation (more likely). I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and delib…

Seems likely a compromise at the GPU or ARM side as equally possible routes.

What do you mean? Both the GPU and CPU design are proprietary to Apple. They used to use regular ARM designed cores but the last one of those before switching to their own core design was something like the A5 days (from memory). It uses the ARM instruction set but isn’t actually designed by ARM at all.

Similar for the GPU too. They may have started with HDL licensed from others (like I think their GPU might actually have been directly based on the PowerVR ones they used to use, but I believe the ARM one is basically from-scratch) but this vulnerability seems unlikely to have existed since then…

Re: Operation Triangulation: What you get when attack iPhones of researchers

#330

Post by x1sec »

throwaway81523 wrote: post #328

Philip Zimmermann a while back was working on a secure phone product called the Black Phone. I tried to convince him that a secure phone should not contain any microphones of any kind. That sounds a bit weird for a phone, but it's ok, if you want to make a voice call, just plug a headset into it for the duration of the call. He wasn't convinced, but this iphone exploit makes me believe it more than ever.

Perhaps a physical switch that connects or disconnects the electrical signal from the microphone to the handset could be a more convenient approach.

There is a photo of Mark Zuckerberg with a cut off 3.5mm jack plugged into his laptop - likely to achieve a similar outcome.

Post reply on HN